Database Authorization via Virtual Multidimensional Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy approaches for delegated data access authorization are inefficient and insecure, particularly in dynamically generated database structures, leading to security information loss and increased resource burdens in high-security environments like healthcare and financial services.
Innovation Solution
The system issues low-latency queries to determine authorization for accessing altered database structures by constructing subject database statements without references to altered data structures, using a virtual multidimensional data model and low-latency directives to reduce latency and ensure secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If legacy delegated authorization approaches are used for dynamically generated database structures, then security information is preserved, but resource burden increases and security information loss occurs
Solution Approach 1:
The system performs preliminary actions by generating altered database structures (aggregates, partitions, materialized views) before they are actually accessed. These structures are pre-processed and staged in a temporary database, so when queries arrive, the system can quickly determine authorization without performing complex real-time analysis on the original dynamic structures, thus reducing resource burden while maintaining security
Solution Approach 2:
The patent introduces an intermediary mechanism - a temporary database that stores altered structures derived from the original dynamic database. This intermediary layer allows the system to evaluate authorization requests against static, pre-processed structures rather than the complex dynamic structures themselves, reducing computational overhead while preserving security through the delegated authorization framework
2Speed
If altered database structures are generated dynamically, then query performance improves, but security authorization becomes complex and resource-intensive
Solution Approach 1:
The system segments the database into multiple altered structures (aggregates, partitions, materialized views) that are stored in a temporary database. Each segment is independently processed and can be evaluated for authorization separately, reducing the complexity of evaluating the entire dynamic structure while maintaining query performance benefits
Solution Approach 2:
The patent creates copies of the original database structures in altered forms (aggregates, partitions, etc.) and stores them in a temporary database. These copies preserve the performance benefits of the altered structures while providing a static target for authorization evaluation, eliminating the complexity of authorizing dynamic structure generation
3Reliability
If delegated authorization is implemented, then access control security improves, but processing overhead increases
Solution Approach 1:
The system performs preliminary authorization-related actions by pre-generating altered database structures and storing them in a temporary database. This preliminary processing reduces the computational overhead during actual authorization decisions, as the system only needs to evaluate access against the pre-processed static structures rather than generating structures in real-time
Solution Approach 2:
The temporary database automatically stores and manages the altered structures derived from the original database, reducing the processing overhead on the main system. The altered structures serve themselves as the authorization evaluation target, eliminating the need for complex real-time structure generation and authorization analysis
Data Source
AI summary
Techniques for determining user authorization to access data in dynamically generated database structures are presented. A method can commence upon receiving database statements from a user that is authorized to access a set of data in a database. A physical plan derived from the received database statements to operate on the database is inspected for references to dynamically generated data structures such as aggregates. A modified physical plan having no aggregates and/or other altered database structures is used to issue low latency database statements to operation on the database for verifying user access authorization to the underlying data. In some cases, the foregoing database statements are based on a virtual multidimensional data model. In other cases, a low latency directive is included in the modified physical plan to facilitate a low latency authorization response.